A SQL injection vulnerability exists in PostgreSQL's EXTRACT() expression deparse functionality, allowing an object owner to execute arbitrary SQL commands with superuser privileges via a malicious object definition. This affects various tools that consume expression deparse output, including pg_dump and psql commands like \sf. The vulnerability impacts multiple PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6.